72-field questionnaire
Open data format, 72 fields with legal basis (NIS-2, CIR 2024/2690, GDPR, CRA, DORA) and ISO/IEC 27001 controls. Entry questions hide what does not apply.
Home / Software & Licences / Supplier Portal
Supply chain security evidence · NIS-2 · DORA · CRA
Supply chain security your customers can see for themselves.
Your suppliers complete the security questionnaire once, 72 fields covering NIS-2, CRA and GDPR plus a dedicated DORA self-assessment, and share their profile with every customer via a personal link: with certificates, SBOM and structured incident and change notifications. A cockpit shows progress and legal-framework coverage. On your own web space or as SaaS in the EU, with no software on the customer side.
The cockpit: progress per questionnaire section and a traffic light for legal-framework coverage.
1Questionnairecompleted once, shared with any number of customers
72Fieldswith EU legal basis and ISO 27001 control for each question
5Legal frameworksNIS-2, DORA, CRA, GDPR and ISO/IEC 27001 in one profile
100 %Data sovereigntyon your web space or hosted in the EU, SQLite instead of a third-party cloud
Features
One tool for the entire supplier evidence process
From self-assessment to DORA, certificates and SBOM to ongoing communication with the customer: everything in one place, with a traceable log.
DORA moduleNEW
Self-assessment under Art. 28–30 for ICT service providers of financial customers, CIF flag per share and export of the Register of Information (RoI) under ITS (EU) 2024/2956.
CockpitNEW
Progress per questionnaire section, key figures on certificates, services and shares, plus a traffic light for coverage of NIS-2, DORA, CRA and GDPR.
Certificates and services
ISO 27001, TISAX, SOC 2 with validity dates and managed services, visible to the customer at a glance.
SBOM (CycloneDX and SPDX)
Upload a software bill of materials; the portal detects format, version and components. Customers download it or view the list directly.
Incident reportsNEW
Structured by agreed taxonomies: affected systems, services, impacts and end customers, multiple choice plus free text, instantly in the customer view.
Change management
Maintain material changes, patch deadlines and updated SBOMs; the customer always sees the current status via their link.
Questionnaire editorNEW
Rename, hide or reorder standard questions and add your own questions: globally, per supplier or by the supplier themselves.
Sharing via link
Each customer receives their own 256-bit link to a read-only view. No login, no registration for the customer.
Print, PDF and JSON export
Print the profile, create a PDF and export it as JSON for import into the customer’s GRC or supplier system.
Backup and restoreNEW
Complete JSON backup including SBOM files, for the whole portal or per supplier. Restore by fully replacing or merging.
Activity log
Who entered or changed what and when: complete, filterable, audit-proof. Including logins and 2FA events.
Use cases
From DORA evidence to ongoing collaboration
The portal carries the evidence across the entire lifecycle: at onboarding, when an incident occurs and when something changes. Everything reaches the customer via the same link, without a single email attachment.
DORA and financial customers
DORA self-assessment with legal basis per field
If a supplier serves financial entities as an ICT third-party service provider, an entry question unlocks the DORA section: LEI, type of ICT service, support of critical or important functions (CIF), contractual and audit rights, incident classification, subcontracting chain, RTO/RPO, resilience testing and exit plan.
- LEI, ICT service type and CIF flag per share for the Register of Information
- Register of Information (RoI) export per financial customer, aligned with ITS (EU) 2024/2956
- Subcontracting chain, data locations, RTO/RPO and exit plan under Art. 28–30
- Every field with DORA article or RTS/ITS and matching ISO 27001 control
Legal basis: DORA Art. 28–30 · RTS (EU) 2024/1773 · 2025/532 · ITS (EU) 2024/2956
Incident management with the customer
Report in a structured way, all affected customers informed
When a supplier publishes a security incident, they select affected systems, services and impacts from agreed taxonomies and add affected end customers and a comment. The incident appears immediately in the view of every connected customer: no mailing list, no forgotten address.
- Affected systems, services and impacts from taxonomies (SYS/SRV/CUS)
- Affected end customers (B2B) and comment, visible in the customer view
- Multiple choice plus free text “Other”; codes appear as readable labels
- Every publication time-stamped in the activity log
Legal basis: NIS-2 Art. 21/23 · CIR 2024/2690 No. 5.1 · DORA Art. 19 · GDPR Art. 33
Change management with the customer
The customer always sees the current status
If something material changes, such as processing locations, certificates, a new software version or a fixed vulnerability, the supplier enters it once. The current version is immediately visible via the customer’s link, including the new SBOM.
- Commitment to inform customers about material changes, including processing locations
- Vulnerability handling and patch deadlines for critical gaps documented
- Updated SBOMs and certificates replace the old ones, without resending
- Version and “last updated” transparent for the customer
Legal basis: CIR 2024/2690 No. 5.1.4 · CRA Annex I Part II · ISO/IEC 27001 A.8
Supplier onboarding
Register suppliers by invitation code, have them complete the self-assessment and track progress centrally in the cockpit.
Audit and examination evidence
Print, PDF, JSON and DORA Register of Information per supplier, with a complete activity log for auditors and supervisors.
Transfer to the customer’s system
The customer exports the profile as JSON and imports it into their GRC or supplier management.
Product tour
Clean and clear for supplier, customer and administrator
Security and data sovereignty
Built as a security product, not retrofitted
Two-factor login
6-digit one-time code by email, stored hashed, failed attempts limited, session ID rotated.
Token access for customers
Customer view only via a 256-bit link, “noindex”, rate-limited: no account, no attack surface.
Passwords and CSRF
bcrypt hashes, CSRF protection on all forms, rate limits for login, code and reset.
Hardening and headers
Content Security Policy with nonce, X-Frame-Options, HSTS; internal areas are blocked from the internet.
Data sovereignty and backup
Everything is stored in one SQLite file, on your web space or on our server in the EU. No external service, plus built-in backup and restore.
Technology and requirements: standard web hosting is enough
- Server environment
- Apache with .htaccess (e.g. IONOS web hosting); nginx with adapted blocking rules also possible.
- PHP
- Version 8.1 or newer with
pdo_sqlite,opensslandmbstring(standard at IONOS). - Database
- No external database needed; data storage is set up automatically during installation.
- Questionnaire
- 72 fields, version 4.1.0, with legal basis and ISO 27001 control per field; adaptable and extendable via the editor.
- DORA register
- Register of Information (RoI) export per financial customer, aligned with ITS (EU) 2024/2956.
- SMTP mailbox for invitations, two-factor codes and password reset.
- Installation
- Upload via SFTP, enter basic settings, run the built-in self-check; no Composer, no Node.js.
- Languages
- German and English, light and dark mode.
- Delivery
- Complete package with online and PDF user guide (role-based), including DORA module, cockpit, questionnaire editor and backup/restore.
Roles
Three perspectives, one portal
Supplier
Maintains the profile
- Questionnaire (72 fields) and DORA
- Certificates, services, SBOM
- Report incidents and changes
- Add their own questions
- Invite and share with customers
Customer
Reads and exports
- Access only via the link
- View profile, certificates, SBOM
- See incidents and end customers
- Export as JSON
- End access at any time
Administrator
Keeps the overview
- All suppliers and users
- Questionnaire editor and additional questions
- Backup and restore, import/export
- Lock accounts, assign rights
- Complete log
Licences and prices
On your web space or as SaaS in the EU
Company-wide licence. The price depends on the number of employees, not on the number of users or suppliers.
Small companies
1–10 employees€590 net
€702.10 incl. 19% VATUpdate fee: €88.50 net per year
Medium-sized companies
11–1,000 employees€3,400 net
€4,046.00 incl. 19% VATUpdate fee: €510.00 net per year
Large companies
over 1,000 employees€4,900 net
€5,831.00 incl. 19% VATUpdate fee: €735.00 net per year
Special licences
Purchase on account, groups of companies, software vendors, consultantsby arrangement
Perpetual licence for the purchased version (option 1). The annual update fee is 15% of the licence cost and covers new versions, questionnaire updates and security updates. With SaaS (option 2), licence and updates are included in the monthly price.
Option 1
Licence on your web space
You run the portal yourself, for example on your own IONOS web hosting. All data stays entirely with you.
- Apache with .htaccess, PHP 8.1 or newer
- No external database, SQLite is created automatically
- Installation via SFTP, without Composer and without Node.js
- Including DORA module, cockpit, questionnaire editor and backup/restore
- Online and PDF user guide (role-based)
Licence by company size + 15% annual update fee
Option 2
SaaS, hosted in the EU
We run the portal for you on servers in the EU. You and your suppliers simply log in, without any technology of your own.
- Hosting in the EU, operation and data backup by us
- Licence and updates included in the monthly price
- Data processing agreement under Art. 28 GDPR
- Ready to go without installation
| Employees | per month | per year |
|---|---|---|
| 1–10 | €54.08 | €649.00 |
| 11–1.000 | €311.67 | €3,740.00 |
| over 1,000 | €449.17 | €5,390.00 |
| Special licence | by arrangement | – |
Prices net plus 19% VAT, annual payment in advance.
Go to the hosted portal →Frequently asked questions
Good to know
Do my customers need an account or their own software?
No. Each customer receives a personal 256-bit link to a read-only view. No login, no registration, no installation.
Which frameworks does the questionnaire cover?
72 fields with legal basis covering NIS-2, Implementing Regulation (EU) 2024/2690, CRA and GDPR, each with the matching ISO/IEC 27001 control, plus a dedicated DORA self-assessment under Art. 28 to 30 with Register of Information export.
Run it yourself or use it as SaaS?
Both are possible: as a perpetual licence on your own web space (from €590 net plus a 15% annual update fee) or as SaaS hosted in the EU, from €54.08 net per month including licence, updates and hosting.
Can we adapt the questionnaire?
Yes. The questionnaire editor lets you rename, hide or reorder standard questions and add your own questions, globally, per supplier or by the supplier themselves.
Who is the Supplier Portal for?
For companies that need to demonstrate the security of their supply chain under NIS2 or DORA, and for suppliers and ICT service providers who want to provide security evidence to their customers without completing a new questionnaire for each one.
Quote and demo
DORA, NIS-2 and CRA: one supplier evidence.
The Supplier Portal can be set up on your web space or used as SaaS and tailored to your suppliers. Request a demo or a quote; on request you receive an invoice instead of online payment.
Developed by a certified expert in information security and IT compliance (CISA, CISM, CIPP/E, CEH). No legal advice.